No confirmation mail if user has already confirmed

(closes pallets-eco#556)

flask_security/views.py

@@ -218,11 +218,14 @@ def confirm_email(token):
     if not user or invalid:
         invalid = True
         do_flash(*get_message('INVALID_CONFIRMATION_TOKEN'))
-    if expired:
+
+    already_confirmed = user is not None and user.confirmed_at is not None
+
+    if expired and not already_confirmed:
         send_confirmation_instructions(user)
         do_flash(*get_message('CONFIRMATION_EXPIRED', email=user.email,
                               within=_security.confirm_email_within))
-    if invalid or expired:
+    if invalid or (expired and not already_confirmed):
         return redirect(get_url(_security.confirm_error_view) or
                         url_for('send_confirmation'))
 

tests/test_confirmable.py

@@ -13,6 +13,7 @@
 from utils import authenticate, logout
 
 from flask_security.core import UserMixin
+from flask_security.confirmable import generate_confirmation_token
 from flask_security.signals import confirm_instructions_sent, user_confirmed
 from flask_security.utils import capture_registrations, string_types
 
@@ -82,6 +83,16 @@ def on_instructions_sent(app, user, token):
     # Test already confirmed
     response = client.get('/confirm/' + token, follow_redirects=True)
     assert get_message('ALREADY_CONFIRMED') in response.data
+    assert len(recorded_instructions_sent) == 2
+
+    # Test already confirmed and expired token
+    app.config['SECURITY_CONFIRM_EMAIL_WITHIN'] = '-1 days'
+    with app.app_context():
+        user = registrations[0]['user']
+        expired_token = generate_confirmation_token(user)
+    response = client.get('/confirm/' + expired_token, follow_redirects=True)
+    assert get_message('ALREADY_CONFIRMED') in response.data
+    assert len(recorded_instructions_sent) == 2
 
     # Test already confirmed when asking for confirmation instructions
     logout(client)